CVE-2026-63276 in LibreOffice
Summary
by MITRE • 09/22/2026
LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written into a fixed size buffer with no check that they still fit, so a glyph emitting many operators wrote past the end of the buffer. In fixed versions the remaining capacity is tracked and the conversion stops when it is used up.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in LibreOffice represents a critical stack-based buffer overflow occurring during the font processing pipeline, specifically within the logic responsible for converting Compact Font Format (CFF) fonts to Type 1 format. This conversion process is triggered automatically when a document containing CFF-embedded fonts is exported or saved as a PDF file through the application's subsetting mechanism. Subsetting is a standard optimization technique used in PDF generation to reduce file size by including only the glyphs actually present in the document rather than embedding entire font files. However, the implementation of this conversion routine contained a fundamental memory safety flaw that allowed for arbitrary code execution under specific conditions involving maliciously crafted fonts or documents with complex glyph definitions.
At the technical core of this vulnerability is an improper boundary check during the translation of CFF operators into their Type 1 equivalents. The software utilized a fixed-size buffer on the stack to store these converted operators without dynamically verifying whether the cumulative size of the generated data would exceed the allocated memory space. When processing glyphs that emit a large number of operators, such as those with complex vector paths or extensive hinting instructions, the conversion routine continued writing past the end of this pre-allocated buffer. This out-of-bounds write operation corrupts adjacent stack memory, potentially overwriting return addresses, function pointers, or other critical control data structures. In fixed versions of LibreOffice, the logic was updated to track remaining buffer capacity in real-time and halt the conversion process once the limit is reached, thereby preventing any overflow from occurring.
The operational impact of this vulnerability is severe due to its potential for remote code execution. An attacker could craft a malicious PDF document containing a specially designed CFF font with glyphs engineered to trigger excessive operator emission during subsetting. When an unsuspecting user opens or exports such a document using the vulnerable version of LibreOffice, the buffer overflow can be exploited to execute arbitrary shellcode on the victim's system. This aligns closely with CWE-121, which defines stack-based buffer overflows as vulnerabilities where data is written beyond the bounds of a fixed-length stack buffer. Furthermore, from an offensive security perspective, this exploitation vector corresponds to ATT&CK technique T1203, which covers Exploitation for Client Execution, specifically targeting office applications through malicious file content rather than network services or web browsers.
Mitigation strategies primarily involve updating LibreOffice to the patched version where the buffer capacity is properly monitored and enforced during font conversion. Organizations should enforce strict software update policies to ensure all endpoints are running versions that include this specific fix. Additionally, users can mitigate risk by disabling automatic PDF export features if not strictly necessary or by using alternative document viewers for untrusted files until updates are applied. Security teams should also consider implementing application whitelisting and macro security restrictions to limit the impact of any successful exploitation attempts. Regular vulnerability scanning focused on office suite versions is recommended to detect instances where this specific patch may be missing from deployed systems.